@getquick/content 0.5.1 → 0.6.0

package/dist/forms-server.js

@@ -1,10 +1,14 @@
-import { c as formDiagnostics, t as FORMS_PATH } from "./descriptor-x8kHFQ79.js";
-import { i as readBoundedBody, n as rateLimitKey, r as isSameOrigin, t as clientAddressResolver } from "./client-ip-cnqPLdDa.js";
-import { n as honeypotFilled, r as validateSubmission } from "./validate-wRgYUNxN.js";
-import { c as formStateLocation, n as formsCopyLanguage, o as formStateCookie, t as FORMS_COPY } from "./copy-DLto_bWj.js";
+import { d as hasUploads, l as formDiagnostics, t as FORMS_PATH } from "./descriptor-DXmLmjEa.js";
+import { a as readBoundedBytes, i as readBoundedBody, n as rateLimitKey, r as isSameOrigin, t as clientAddressResolver } from "./client-ip-NKt34dBM.js";
+import { n as honeypotFilled, r as validateSubmission, s as validateUploads } from "./validate-CqP_F0bk.js";
+import { c as formStateLocation, n as formsCopyLanguage, o as formStateCookie, t as FORMS_COPY } from "./copy-CfNr6M73.js";
 //#region frontend/src/forms/server.ts
 /** The largest form body accepted (bytes); larger posts are refused unread. */
 const MAX_FORM_BYTES = 65536;
+/** The largest multipart (upload) body accepted by default (bytes), files included. */
+const MAX_UPLOAD_BYTES = 10485760;
+/** The most `maxUploadBytes` may be: the Worker holds a post in memory. */
+const MAX_UPLOAD_BYTES_LIMIT = 33554432;
 /** Cloudflare's server-side Turnstile verification. */
 const TURNSTILE_SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** The field Turnstile's widget posts its token in. */
@@ -26,6 +30,9 @@ function createFormsServer(config) {
 	const origins = new Set((config.siteOrigins ?? []).map((origin) => new URL(origin).origin));
 	const clientAddress = clientAddressResolver(config.trustedProxies);
 	const timeoutMs = config.timeoutMs ?? 15e3;
+	const uploadTimeoutMs = config.timeoutMs ?? 6e4;
+	const maxUploadBytes = config.maxUploadBytes ?? 10485760;
+	if (!Number.isInteger(maxUploadBytes) || maxUploadBytes < 65536 || maxUploadBytes > 33554432) throw new Error(`maxUploadBytes must be a whole number of bytes from ${MAX_FORM_BYTES} to ${MAX_UPLOAD_BYTES_LIMIT}`);
 	const fetcher = config.fetch ?? globalThis.fetch.bind(globalThis);
 	const copy = FORMS_COPY[formsCopyLanguage(config.language)];
 	const turnstileRequired = config.spam?.turnstile === true;
@@ -64,6 +71,7 @@ function createFormsServer(config) {
 			invalid: 422,
 			verification: 422,
 			"too-many": 429,
+			"too-large": 413,
 			failed: 502
 		}[full.status], {
 			status: full.status,
@@ -98,12 +106,15 @@ function createFormsServer(config) {
 			return false;
 		}
 	}
-	/** Gravity Forms' field messages, by field id. */
+	/** Gravity Forms' field messages, by field id; a multiple file upload's list is joined. */
 	function fieldMessages(value) {
 		if (!value || typeof value !== "object") return {};
-		return Object.fromEntries(Object.entries(value).flatMap(([id, message]) => /^\d+$/.test(id) && typeof message === "string" && message ? [[Number(id), htmlText(message)]] : []));
+		return Object.fromEntries(Object.entries(value).flatMap(([id, message]) => {
+			const text = (Array.isArray(message) ? message : [message]).filter((each) => typeof each === "string" && each !== "").map(htmlText).filter(Boolean).join("\n");
+			return /^\d+$/.test(id) && text ? [[Number(id), text]] : [];
+		}));
 	}
-	async function submit(request, formId, source, params) {
+	async function submit(request, formId, source, params, files) {
 		const bindings = await config.bindings();
 		let descriptor;
 		try {
@@ -134,10 +145,15 @@ function createFormsServer(config) {
 		};
 		if (honeypotFilled(descriptor, params)) return outcome(request, sent, source);
 		const checked = validateSubmission(descriptor, params);
-		if (Object.keys(checked.errors).length) return outcome(request, {
+		const uploads = await validateUploads(descriptor, files);
+		const errors = {
+			...checked.errors,
+			...uploads.errors
+		};
+		if (Object.keys(errors).length) return outcome(request, {
 			formId,
 			status: "invalid",
-			errors: checked.errors,
+			errors,
 			values: checked.values
 		}, source);
 		if (turnstileRequired) {
@@ -166,18 +182,25 @@ function createFormsServer(config) {
 				values: checked.values
 			}, source);
 		}
+		const multipart = hasUploads(descriptor);
+		let body = JSON.stringify(checked.input);
+		if (multipart) {
+			body = new FormData();
+			for (const [name, value] of Object.entries(checked.input)) body.append(name, value);
+			for (const each of uploads.files) body.append(each.name, new Blob([each.file], { type: each.type }), each.filename);
+		}
 		let response;
 		try {
 			response = await fetcher(`${restRoot}/gf/v2/forms/${formId}/submissions`, {
 				method: "POST",
 				headers: {
-					"Content-Type": "application/json",
+					...multipart ? {} : { "Content-Type": "application/json" },
 					Accept: "application/json",
 					...access
 				},
-				body: JSON.stringify(checked.input),
+				body,
 				redirect: "manual",
-				signal: AbortSignal.timeout(timeoutMs)
+				signal: AbortSignal.timeout(multipart ? uploadTimeoutMs : timeoutMs)
 			});
 		} catch (error) {
 			console.error(`Forms: form ${formId} couldn't reach the CMS: ${error.name}`);
@@ -241,15 +264,45 @@ function createFormsServer(config) {
 			values: checked.values
 		}, source);
 	}
+	/**
+	* A post over its cap. A form with uploads also names its page in the action
+	* (`?gq_source=`), so the visitor is sent back to it with the outcome.
+	*/
+	function tooLarge(request, formId) {
+		const source = new URL(request.url).searchParams.get("gq_source") ?? "";
+		if (SOURCE.test(source) && source.length <= 2048) return outcome(request, {
+			formId,
+			status: "too-large"
+		}, source);
+		return json(413, { error: "The form is too large." });
+	}
 	/** `POST /gq/forms/<id>`. */
 	async function handlePost(request, formId) {
 		if (request.method !== "POST") return json(405, { error: "Send forms with POST." }, { Allow: "POST" });
 		if (!isSameOrigin(request, origins)) return json(403, { error: "Forms are accepted from this Site only." });
-		if (!/^application\/x-www-form-urlencoded\b/i.test(request.headers.get("Content-Type") ?? "")) return json(415, { error: "Send the form as application/x-www-form-urlencoded." });
+		const type = request.headers.get("Content-Type") ?? "";
+		const multipart = /^multipart\/form-data\b/i.test(type);
+		if (!multipart && !/^application\/x-www-form-urlencoded\b/i.test(type)) return json(415, { error: "Send the form as application/x-www-form-urlencoded or multipart/form-data." });
 		const bindings = await config.bindings();
-		const text = await readBoundedBody(request, MAX_FORM_BYTES);
-		if (text === null) return json(413, { error: "The form is too large." });
-		const params = new URLSearchParams(text);
+		let params;
+		let files = { getAll: () => [] };
+		if (multipart) {
+			const bytes = await readBoundedBytes(request, maxUploadBytes);
+			if (bytes === null) return tooLarge(request, formId);
+			let data;
+			try {
+				data = await new Response(bytes, { headers: { "Content-Type": type } }).formData();
+			} catch {
+				return json(400, { error: "The form isn't valid multipart/form-data." });
+			}
+			params = new URLSearchParams();
+			for (const [name, value] of data) if (typeof value === "string") params.append(name, value);
+			files = data;
+		} else {
+			const text = await readBoundedBody(request, MAX_FORM_BYTES);
+			if (text === null) return tooLarge(request, formId);
+			params = new URLSearchParams(text);
+		}
 		const source = params.get("gq_source") ?? "";
 		if (!SOURCE.test(source) || source.length > 2048) return json(400, { error: "The form's page (gq_source) isn't a path on this Site." });
 		const limiter = bindings.FORMS_RATE_LIMITER;
@@ -260,7 +313,7 @@ function createFormsServer(config) {
 				status: "too-many"
 			}, source);
 		}
-		return submit(request, formId, source, params);
+		return submit(request, formId, source, params, files);
 	}
 	/** Routes a form post; null when the path isn't a form endpoint. */
 	async function handle(request) {
@@ -283,6 +336,7 @@ function createFormsServer(config) {
 			turnstileSecret: Boolean(bindings.TURNSTILE_SECRET_KEY?.trim()),
 			access: access === "partial" ? "partial" : Object.keys(access).length ? "configured" : "none",
 			rateLimit: Boolean(bindings.FORMS_RATE_LIMITER),
+			maxUploadBytes,
 			ready: (!turnstileRequired || Boolean(bindings.TURNSTILE_SECRET_KEY?.trim())) && access !== "partial"
 		};
 	}
@@ -292,4 +346,4 @@ function createFormsServer(config) {
 	};
 }
 //#endregion
-export { FORMS_PATH, MAX_FORM_BYTES, TURNSTILE_RESPONSE_FIELD, TURNSTILE_SITEVERIFY_URL, createFormsServer, htmlText };
+export { FORMS_PATH, MAX_FORM_BYTES, MAX_UPLOAD_BYTES, MAX_UPLOAD_BYTES_LIMIT, TURNSTILE_RESPONSE_FIELD, TURNSTILE_SITEVERIFY_URL, createFormsServer, htmlText };

package/dist/forms-testing.d.ts

@@ -1,9 +1,21 @@
-import { o as FormDescriptor } from "./descriptor-B-e7gHi1.js";
+import { o as FormDescriptor } from "./descriptor-BF5Y9a1J.js";
 //#region frontend/src/forms/testing.d.ts
 /** A contact form like Nomia's form 1: name, email, subject, message and privacy consent. */
 export declare const CONTACT_FORM: FormDescriptor;
-/** A form readiness must fail: Gravity Forms' CAPTCHA, a file upload, a payment field and a page break. */
+/** A form readiness must fail: Gravity Forms' CAPTCHA, an upload of files the Frontend can't verify, a payment field and a page break. */
 export declare const UNSUPPORTED_FORM: FormDescriptor;
+/** The upload settings Sites use for images and PDFs: 5 MB per file, up to 5 files. */
+export declare const IMAGE_AND_PDF_UPLOAD: {
+  allowedExtensions: string[];
+  maxFileSize: number;
+  multipleFiles: boolean;
+  maxFiles: number;
+};
+/**
+ * A public submission form like Nomia's /partilhe/: name, email, a content
+ * type, title, content, image and PDF attachments, and privacy consent.
+ */
+export declare const SUBMISSION_FORM: FormDescriptor;
 /** A referenced form that is missing, inactive or trashed. */
 export declare const UNAVAILABLE_FORM: FormDescriptor;
 /** Keys that must never appear anywhere in a delivered descriptor. */
@@ -20,24 +32,43 @@ export declare function assertPublicDescriptor(value: unknown): FormDescriptor;
  * an alert and a confirmation is a status.
  */
 export declare function assertAccessibleForm(html: string): void;
+/** A file Gravity Forms' stand-in received. */
+export interface RecordedFile {
+  /** The file name it was posted with. */
+  filename: string;
+  /** The Content-Type it was posted with. */
+  type: string;
+  size: number;
+  /** Its first bytes, hex (for signature checks). */
+  head: string;
+}
 /** A request Gravity Forms' stand-in received. */
 export interface RecordedRequest {
   method: string;
   url: string;
   headers: Record<string, string>;
+  /** JSON's values, or a multipart body's text values. */
   body: Record<string, string> | null;
+  /** A multipart body's files, by the name they were posted under (`input_6[]`). */
+  files?: Record<string, RecordedFile[]>;
 }
 export interface StoredEntry {
   formId: number;
   values: Record<string, string>;
+  /** Files stored with the entry, by field input name (`input_6`). */
+  files: Record<string, RecordedFile[]>;
   spam: boolean;
 }
 /**
  * A stand-in for Gravity Forms' REST API on a CMS: `POST
  * /wp-json/gf/v2/forms/<id>/submissions` as Gravity Forms 3.2 answers it,
  * validating required fields and storing entries for the given descriptors.
- * A filled honeypot is stored as spam, Gravity Forms' default honeypot
- * action. Anything else is a 404. `requests` records every request.
+ * It takes JSON, or multipart/form-data whose files are `input_<id>` (one) or
+ * `input_<id>[]` (several), as Gravity Forms reads `$_FILES`, and checks their
+ * count, size and extension as Gravity Forms does (a multiple upload's
+ * messages are a list). A filled honeypot is stored as spam, Gravity Forms'
+ * default honeypot action. Anything else is a 404. `requests` records every
+ * request.
  */
 export declare function gravityFormsStub(forms: readonly FormDescriptor[]): {
   entries: StoredEntry[];
@@ -52,6 +83,31 @@ export declare function assertNoEntryReadsOrCredentials(requests: readonly Recor
 export declare function assertNoEntryExports(module: Record<string, unknown>): void;
 /** A form body as a browser posts it (application/x-www-form-urlencoded). */
 export declare function formBody(values: Record<string, string>): string;
+/** Minimal files of each format the form endpoint verifies, as their signatures start. */
+export declare const SAMPLE_FILES: {
+  readonly jpg: readonly [255, 216, 255, 224, 0, 16, 74, 70, 73, 70, 0, 1];
+  readonly png: readonly [137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13];
+  readonly gif: readonly [...number[], 1, 0, 1, 0, 0, 0];
+  readonly webp: readonly number[];
+  readonly pdf: readonly number[];
+  /** A Windows executable: what a renamed attachment can really be. */
+  readonly exe: readonly [77, 90, 144, 0, 3, 0, 0, 0, 4, 0, 0, 0];
+};
+/**
+ * A file as a browser posts it: `kind`'s signature, padded to `size` bytes,
+ * with `type` as the client's claimed MIME type (never trusted).
+ */
+export declare function sampleFile(filename: string, kind: keyof typeof SAMPLE_FILES, options?: {
+  size?: number;
+  type?: string;
+}): File;
+/**
+ * A multipart form body as a browser posts it: the values, then each field's
+ * files under its input name (several under the same name, as `multiple` does).
+ */
+export declare function multipartBody(values: Record<string, string>, files?: Record<string, File | readonly File[]>): FormData;
+/** A filled-in, valid submission of SUBMISSION_FORM from `source` (attach files with multipartBody). */
+export declare function submissionValues(source?: string): Record<string, string>;
 /** A filled-in, valid submission of CONTACT_FORM from `source`. */
 export declare function contactSubmission(source?: string): Record<string, string>;
 /** Cloudflare's Turnstile test keys: always pass, always fail. */

package/dist/forms-testing.js

@@ -1,4 +1,4 @@
-import { u as parseFormDescriptor } from "./descriptor-x8kHFQ79.js";
+import { p as parseFormDescriptor } from "./descriptor-DXmLmjEa.js";
 //#region frontend/src/forms/testing.ts
 /** A contact form like Nomia's form 1: name, email, subject, message and privacy consent. */
 const CONTACT_FORM = {
@@ -106,7 +106,7 @@ const CONTACT_FORM = {
 	},
 	diagnostics: []
 };
-/** A form readiness must fail: Gravity Forms' CAPTCHA, a file upload, a payment field and a page break. */
+/** A form readiness must fail: Gravity Forms' CAPTCHA, an upload of files the Frontend can't verify, a payment field and a page break. */
 const UNSUPPORTED_FORM = {
 	...CONTACT_FORM,
 	id: 2,
@@ -123,7 +123,7 @@ const UNSUPPORTED_FORM = {
 			code: "unsupported-file-upload",
 			fieldId: 11,
 			type: "fileupload",
-			message: "File upload"
+			message: "The Frontend can't verify docx files: allow only jpg, jpeg, png, gif, webp, pdf."
 		},
 		{
 			code: "unsupported-payment",
@@ -139,6 +139,167 @@ const UNSUPPORTED_FORM = {
 		}
 	]
 };
+/** The upload settings Sites use for images and PDFs: 5 MB per file, up to 5 files. */
+const IMAGE_AND_PDF_UPLOAD = {
+	allowedExtensions: [
+		"jpg",
+		"jpeg",
+		"png",
+		"webp",
+		"gif",
+		"pdf"
+	],
+	maxFileSize: 5242880,
+	multipleFiles: true,
+	maxFiles: 5
+};
+/**
+* A public submission form like Nomia's /partilhe/: name, email, a content
+* type, title, content, image and PDF attachments, and privacy consent.
+*/
+const SUBMISSION_FORM = {
+	schema: 1,
+	id: 6,
+	available: true,
+	title: "Partilhe",
+	description: "Envie-nos conteúdos para publicação.",
+	submitLabel: "Enviar",
+	fields: [
+		{
+			id: 1,
+			type: "text",
+			label: "Nome",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "1",
+				name: "input_1",
+				label: "Nome"
+			}]
+		},
+		{
+			id: 2,
+			type: "email",
+			label: "Email",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "2",
+				name: "input_2",
+				label: "Email"
+			}]
+		},
+		{
+			id: 3,
+			type: "select",
+			label: "Tipo de conteúdo",
+			description: "",
+			required: true,
+			visibility: "visible",
+			choices: [
+				{
+					text: "Notícia",
+					value: "noticia",
+					selected: false
+				},
+				{
+					text: "Evento",
+					value: "evento",
+					selected: false
+				},
+				{
+					text: "Publicação",
+					value: "publicacao",
+					selected: false
+				}
+			],
+			inputs: [{
+				id: "3",
+				name: "input_3",
+				label: "Tipo de conteúdo"
+			}]
+		},
+		{
+			id: 4,
+			type: "text",
+			label: "Título",
+			description: "",
+			required: true,
+			visibility: "visible",
+			maxLength: 200,
+			inputs: [{
+				id: "4",
+				name: "input_4",
+				label: "Título"
+			}]
+		},
+		{
+			id: 5,
+			type: "textarea",
+			label: "Conteúdo",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "5",
+				name: "input_5",
+				label: "Conteúdo"
+			}]
+		},
+		{
+			id: 6,
+			type: "fileupload",
+			label: "Anexos",
+			description: "Imagens ou documentos PDF.",
+			required: false,
+			visibility: "visible",
+			inputs: [{
+				id: "6",
+				name: "input_6",
+				label: "Anexos"
+			}],
+			upload: IMAGE_AND_PDF_UPLOAD
+		},
+		{
+			id: 7,
+			type: "consent",
+			label: "Privacidade",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [
+				{
+					id: "7.1",
+					name: "input_7_1",
+					label: "Consentimento"
+				},
+				{
+					id: "7.2",
+					name: "input_7_2",
+					label: "Texto"
+				},
+				{
+					id: "7.3",
+					name: "input_7_3",
+					label: "Descrição"
+				}
+			],
+			consent: {
+				checkboxLabel: "Aceito o tratamento dos meus dados para analisar este conteúdo.",
+				description: "",
+				revisionId: "2"
+			}
+		}
+	],
+	honeypot: { name: "input_8" },
+	confirmation: {
+		type: "message",
+		message: "Obrigado. Vamos analisar o seu conteúdo."
+	},
+	diagnostics: []
+};
 /** A referenced form that is missing, inactive or trashed. */
 const UNAVAILABLE_FORM = {
 	...CONTACT_FORM,
@@ -217,14 +378,32 @@ function assertAccessibleForm(html) {
 	if (/gq-form__errors/.test(html) && !/class="gq-form__errors" role="alert"/.test(html)) problems.push("the error summary isn't an alert");
 	if (/gq-form__status--sent/.test(html) && !/gq-form__status--sent" role="status"/.test(html)) problems.push("the confirmation isn't a status message");
 	if (/<form\b/.test(html) && !/<button type="submit"/.test(html)) problems.push("the form has no submit button");
+	for (const match of html.matchAll(/<input type="file"([^>]*)>/g)) {
+		const id = /\sid="([^"]+)"/.exec(match[1])?.[1];
+		if (!/aria-describedby="[^"]*-hint\b/.test(match[1])) problems.push(`${id} doesn't describe which files it accepts`);
+	}
+	if (/<input type="file"/.test(html) && !/<form\b[^>]*\senctype="multipart\/form-data"/.test(html)) problems.push("a file input is in a form that doesn't send files");
 	if (problems.length) throw new Error(`Inaccessible form: ${problems.join("; ")}`);
 }
+async function recordFile(file) {
+	const head = new Uint8Array(await file.slice(0, 12).arrayBuffer());
+	return {
+		filename: file.name ?? "",
+		type: file.type,
+		size: file.size,
+		head: [...head].map((byte) => byte.toString(16).padStart(2, "0")).join("")
+	};
+}
 /**
 * A stand-in for Gravity Forms' REST API on a CMS: `POST
 * /wp-json/gf/v2/forms/<id>/submissions` as Gravity Forms 3.2 answers it,
 * validating required fields and storing entries for the given descriptors.
-* A filled honeypot is stored as spam, Gravity Forms' default honeypot
-* action. Anything else is a 404. `requests` records every request.
+* It takes JSON, or multipart/form-data whose files are `input_<id>` (one) or
+* `input_<id>[]` (several), as Gravity Forms reads `$_FILES`, and checks their
+* count, size and extension as Gravity Forms does (a multiple upload's
+* messages are a list). A filled honeypot is stored as spam, Gravity Forms'
+* default honeypot action. Anything else is a 404. `requests` records every
+* request.
 */
 function gravityFormsStub(forms) {
 	const entries = [];
@@ -232,8 +411,15 @@ function gravityFormsStub(forms) {
 	async function handle(request) {
 		const url = new URL(request.url);
 		let body = null;
+		let files;
 		try {
-			body = request.method === "POST" ? await request.json() : null;
+			if (request.method !== "POST") body = null;
+			else if (/^multipart\/form-data\b/i.test(request.headers.get("Content-Type") ?? "")) {
+				body = {};
+				files = {};
+				for (const [name, value] of await request.formData()) if (typeof value === "string") body[name] = value;
+				else (files[name] ??= []).push(await recordFile(value));
+			} else body = await request.json();
 		} catch {
 			body = null;
 		}
@@ -241,7 +427,8 @@ function gravityFormsStub(forms) {
 			method: request.method,
 			url: url.pathname + url.search,
 			headers: Object.fromEntries(request.headers),
-			body
+			body,
+			...files ? { files } : {}
 		});
 		const match = /^\/wp-json\/gf\/v2\/forms\/(\d+)\/submissions$/.exec(url.pathname);
 		const form = match && forms.find((each) => each.id === Number(match[1]));
@@ -252,7 +439,31 @@ function gravityFormsStub(forms) {
 		}, { status: 400 });
 		const values = body ?? {};
 		const messages = {};
+		const stored = {};
 		for (const field of form.fields) {
+			if (field.type === "fileupload") {
+				const name = field.inputs[0]?.name ?? `input_${field.id}`;
+				const posted = [...files?.[name] ?? [], ...files?.[`${name}[]`] ?? []];
+				const upload = field.upload;
+				if (posted.length === 0) {
+					if (field.required) messages[field.id] = "This field is required.";
+					continue;
+				}
+				const limit = upload?.multipleFiles ? upload.maxFiles : 1;
+				if (limit && posted.length > limit) {
+					messages[field.id] = `Number of files (${posted.length}) exceeds limit (${limit}).`;
+					continue;
+				}
+				const invalid = posted.flatMap((file) => {
+					const extension = /\.([^.]+)$/.exec(file.filename)?.[1]?.toLowerCase() ?? "";
+					if (upload && !upload.allowedExtensions.includes(extension)) return [`${file.filename} - The uploaded file type is not allowed.`];
+					if (upload && file.size > upload.maxFileSize) return [`${file.filename} - File exceeds size limit.`];
+					return [];
+				});
+				if (invalid.length) messages[field.id] = upload?.multipleFiles ? invalid : invalid[0];
+				else stored[name] = posted;
+				continue;
+			}
 			if (!field.required) continue;
 			if ((field.type === "consent" ? [field.inputs[0].name] : field.inputs.map((input) => input.name)).every((name) => !values[name])) messages[field.id] = "This field is required.";
 		}
@@ -266,6 +477,7 @@ function gravityFormsStub(forms) {
 		entries.push({
 			formId: form.id,
 			values,
+			files: stored,
 			spam
 		});
 		return Response.json({
@@ -308,6 +520,103 @@ function assertNoEntryExports(module) {
 function formBody(values) {
 	return new URLSearchParams(values).toString();
 }
+/** Minimal files of each format the form endpoint verifies, as their signatures start. */
+const SAMPLE_FILES = {
+	jpg: [
+		255,
+		216,
+		255,
+		224,
+		0,
+		16,
+		74,
+		70,
+		73,
+		70,
+		0,
+		1
+	],
+	png: [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10,
+		0,
+		0,
+		0,
+		13
+	],
+	gif: [
+		...new TextEncoder().encode("GIF89a"),
+		1,
+		0,
+		1,
+		0,
+		0,
+		0
+	],
+	webp: [
+		...new TextEncoder().encode("RIFF"),
+		36,
+		0,
+		0,
+		0,
+		...new TextEncoder().encode("WEBPVP8 ")
+	],
+	pdf: [...new TextEncoder().encode("%PDF-1.7\n%âã")],
+	/** A Windows executable: what a renamed attachment can really be. */
+	exe: [
+		77,
+		90,
+		144,
+		0,
+		3,
+		0,
+		0,
+		0,
+		4,
+		0,
+		0,
+		0
+	]
+};
+/**
+* A file as a browser posts it: `kind`'s signature, padded to `size` bytes,
+* with `type` as the client's claimed MIME type (never trusted).
+*/
+function sampleFile(filename, kind, options = {}) {
+	const head = Uint8Array.from(SAMPLE_FILES[kind]);
+	const bytes = new Uint8Array(Math.max(options.size ?? 256, head.length));
+	bytes.set(head);
+	return new File([bytes], filename, { type: options.type ?? "application/octet-stream" });
+}
+/**
+* A multipart form body as a browser posts it: the values, then each field's
+* files under its input name (several under the same name, as `multiple` does).
+*/
+function multipartBody(values, files = {}) {
+	const body = new FormData();
+	for (const [name, value] of Object.entries(values)) body.append(name, value);
+	for (const [name, chosen] of Object.entries(files)) for (const file of Array.isArray(chosen) ? chosen : [chosen]) body.append(name, file);
+	return body;
+}
+/** A filled-in, valid submission of SUBMISSION_FORM from `source` (attach files with multipartBody). */
+function submissionValues(source = "/partilhe/") {
+	return {
+		gq_source: source,
+		input_1: "Ana Silva",
+		input_2: "ana@example.com",
+		input_3: "evento",
+		input_4: "Feira da bioeconomia",
+		input_5: "Um evento sobre bioeconomia circular.",
+		input_7_1: "1",
+		input_8: ""
+	};
+}
 /** A filled-in, valid submission of CONTACT_FORM from `source`. */
 function contactSubmission(source = "/contactos/") {
 	return {
@@ -331,4 +640,4 @@ const TURNSTILE_TEST_KEYS = {
 	dummyToken: "XXXX.DUMMY.TOKEN.XXXX"
 };
 //#endregion
-export { CONTACT_FORM, PRIVATE_FORM_KEYS, TURNSTILE_TEST_KEYS, UNAVAILABLE_FORM, UNSUPPORTED_FORM, assertAccessibleForm, assertNoEntryExports, assertNoEntryReadsOrCredentials, assertPublicDescriptor, contactSubmission, formBody, gravityFormsStub };
+export { CONTACT_FORM, IMAGE_AND_PDF_UPLOAD, PRIVATE_FORM_KEYS, SAMPLE_FILES, SUBMISSION_FORM, TURNSTILE_TEST_KEYS, UNAVAILABLE_FORM, UNSUPPORTED_FORM, assertAccessibleForm, assertNoEntryExports, assertNoEntryReadsOrCredentials, assertPublicDescriptor, contactSubmission, formBody, gravityFormsStub, multipartBody, sampleFile, submissionValues };